N10-009 Practice Test 21 — 15 Questions

Question 1

An NOC technician receives an alert that latency on a critical WAN link has increased significantly. The technician needs to analyze the latency trend over the past week to identify patterns. Which approach is the most efficient for gathering this historical data?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use SNMP polling with a suitable MIB to collect latency metrics at regular intervals. SNMP polling with a suitable MIB (e.g., IF-MIB for interface statistics or IP-MIB for performance metrics) allows the NOC to collect latency data at regular, configurable intervals over time. This historical data can be stored in a management system and analyzed for trends, making it the most efficient method for identifying patterns in WAN latency over a week. SNMP traps, by contrast, are event-driven and do not provide the continuous, periodic data needed for trend analysis.

Answer

Use SNMP traps to alert on each latency spike

Answer

Run a continuous ping test and manually log timestamps

Answer

Use traceroute to identify each hop and measure latency per hop

Question 2

A technician is troubleshooting intermittent wireless connectivity in a conference room. A site survey shows strong signal strength but many nearby access points are using channels that overlap with the channel used by the conference room AP. Which of the following is the most likely cause of the issue?

Accepted Answer

Adjacent channel interference from access points on overlapping channels.. The site survey shows strong signal strength but many nearby access points are using channels that overlap with the channel used by the conference room AP. This directly indicates adjacent-channel interference (ACI), where overlapping channels (e.g., channels 1, 2, 3, 4, and 5 all overlap with channel 1 in the 2.4 GHz band) cause contention and retransmissions, degrading performance even with strong signal. ACI is the most likely cause because the overlapping channels create co-existence issues without being on the exact same channel.

Answer

Multipath interference from reflective surfaces.

Answer

Co-channel interference from access points on the same channel.

Answer

Signal attenuation due to distance from the AP.

Question 3

An NOC technician observes that the average latency on a critical WAN link has risen sharply. To determine which applications are consuming the most bandwidth and contributing to the latency, which tool should the technician use?

Accepted Answer

A) NetFlow. NetFlow is the correct tool because it provides per-flow traffic analysis, allowing the technician to identify which applications (by protocol and port) are consuming the most bandwidth on the WAN link. Unlike simple bandwidth monitors, NetFlow exports detailed records of source/destination IPs, ports, and byte counts, enabling precise identification of bandwidth-hungry applications contributing to increased latency.

Answer

B) SNMP

Answer

C) Syslog

Answer

D) Ping

Question 4

A company wants to prevent unauthorized users from plugging into network jacks and gaining access to the wired network. Which of the following security mechanisms should be implemented at the switch level?

Accepted Answer

802.1X. 802.1X is a port-based Network Access Control (NAC) standard (IEEE 802.1X) that authenticates devices before granting full network access. When a device plugs into a switch port, the switch (as the authenticator) blocks all traffic except EAPoL (Extensible Authentication Protocol over LAN) frames until the device successfully authenticates via a RADIUS server. This prevents unauthorized users from gaining network access simply by connecting to a live jack.

Answer

MAC address filtering

Answer

Port security

Answer

Dynamic ARP Inspection

Question 5

A network administrator needs to monitor network traffic to identify which hosts are consuming the most bandwidth. Which of the following tools is BEST suited for this task?

Accepted Answer

NetFlow. NetFlow is the best tool for monitoring network traffic to identify bandwidth consumption by hosts because it collects and analyzes IP traffic flow data, providing detailed visibility into source/destination IPs, protocols, and byte counts. Unlike simple interface counters, NetFlow allows an administrator to pinpoint which specific hosts are generating the most traffic, making it ideal for bandwidth usage analysis.

Answer

Syslog server

Answer

SNMP trap

Answer

Traceroute

Question 6

A network administrator needs to connect two buildings 2 km apart using single-mode fiber. Which transceiver type should be used?

Accepted Answer

1000BASE-LX. 1000BASE-LX (Long Wavelength) operates at 1310 nm over single-mode fiber and supports distances up to 5 km (and often up to 10 km with proper link budgets), making it the correct choice for a 2 km link. Single-mode fiber is required for distances beyond 550 m, and 1000BASE-LX is the Gigabit Ethernet standard designed for such single-mode runs.

Answer

1000BASE-T

Answer

1000BASE-SX

Answer

10GBASE-SR

Question 7

A network administrator is setting up SNMPv3 on a router for secure monitoring. Which of the following is required for SNMPv3 authentication?

Accepted Answer

Username and password. SNMPv3 introduces a security model that requires a username and password (authentication passphrase) for authentication, moving away from the community-string-based model of SNMPv1/v2c. The password is used with an authentication protocol like MD5 or SHA to verify the identity of the manager before allowing access. Without a valid username and password combination, SNMPv3 will reject the request.

Answer

Community string

Answer

Encryption key

Answer

Public key

Question 8

A security analyst is reviewing DHCP server logs and notices that a single MAC address is sending an extremely high number of DHCP discover packets. The DHCP server is responding, but the client never sends a DHCP request. Which type of attack is most likely occurring?

Accepted Answer

A) DHCP starvation. A DHCP starvation attack works by flooding the DHCP server with DHCPDISCOVER packets from spoofed MAC addresses, exhausting the server's IP address pool. In this scenario, a single MAC address sending excessive DHCPDISCOVER packets without completing the DORA handshake (no DHCPREQUEST) is a classic indicator of a starvation attack, as the attacker aims to consume all available leases and cause a denial of service for legitimate clients.

Answer

B) ARP poisoning

Answer

C) MAC flooding

Answer

D) DNS spoofing

Question 9

A company is extending its network to a new building located 200 meters away. The link must support 1 Gbps speeds. Which cabling type should be used?

Accepted Answer

Single-mode fiber. Single-mode fiber (SMF) is the correct choice because it supports 1 Gbps speeds over distances far exceeding 200 meters, typically up to 5 km or more using 1000BASE-LX optics. Copper cabling like Cat5e and Cat6 is limited to a maximum segment length of 100 meters for 1 Gbps (1000BASE-T), making them unsuitable for this 200-meter link.

Answer

Cat5e

Answer

Cat6

Answer

Coaxial cable

Question 10

Which network topology connects all devices to a central device?

Accepted Answer

Star. In a star topology, each device connects directly to a central device such as a switch or hub. This central device manages all communication between endpoints, meaning any data sent from one device must pass through the central point before reaching its destination. This design simplifies fault isolation because a single cable failure only affects the connected device, not the entire network.

Answer

Mesh

Answer

Bus

Answer

Ring

Question 11

A company wants to prevent unauthorized personal devices from connecting to the corporate wired network. Employees must authenticate using their domain credentials before gaining full network access. Which security measure should be implemented on the switch ports?

Accepted Answer

802.1X. 802.1X is the correct choice because it provides port-based network access control (PNAC) that requires end devices to authenticate using domain credentials (e.g., via RADIUS) before being granted full network access. This ensures that only authorized users, not just authorized devices, can connect to the corporate wired network, meeting the requirement to prevent unauthorized personal devices.

Answer

MAC filtering

Answer

Port security with sticky MAC

Answer

VLAN hopping prevention

Question 12

Which protocol is used to resolve a known IP address to a corresponding MAC address on a local network?

Accepted Answer

ARP. ARP (Address Resolution Protocol) is used to resolve a known IP address to its corresponding MAC address on a local network. When a host needs to send a frame to another host on the same subnet, it broadcasts an ARP request containing the target IP; the host with that IP responds with its MAC address, which is then cached for future use.

Answer

DNS

Answer

DHCP

Answer

ICMP

Question 13

A network administrator needs to analyze bandwidth usage by application and identify top talkers on the network. Which protocol or technology should be used to export detailed traffic flow information from routers and switches to a central collector?

Accepted Answer

NetFlow. NetFlow is the correct choice because it is a Cisco-developed protocol designed specifically to export detailed IP traffic flow information—including source/destination IPs, ports, protocols, and byte counts—from routers and switches to a central collector for bandwidth usage analysis and top talker identification. Unlike simpler monitoring tools, NetFlow provides per-flow granularity, enabling administrators to pinpoint which applications and hosts are consuming the most bandwidth.

Answer

SNMP

Answer

ICMP

Answer

SMTP

Question 14

At which layer of the OSI model does a switch that uses MAC addresses to forward frames operate?

Accepted Answer

Layer 2. A switch that uses MAC addresses to forward frames operates at Layer 2 (Data Link layer) of the OSI model. Layer 2 is responsible for node-to-node data transfer and error detection, using MAC addresses as the addressing scheme. The switch builds a MAC address table by learning source MAC addresses from incoming frames and then forwards frames based on the destination MAC address, making forwarding decisions at this layer.

Answer

Layer 1

Answer

Layer 3

Answer

Layer 4

Question 15

A company wants to ensure that only users who have successfully authenticated Active Directory credentials can access the wired network. The network switches support IEEE 802.1X. Which additional component must be deployed to complete the solution?

Accepted Answer

A RADIUS server. IEEE 802.1X port-based authentication requires a RADIUS server to act as the authentication server. The switch (authenticator) forwards the user's credentials to the RADIUS server, which validates them against Active Directory and returns an accept or reject decision. Without a RADIUS server, the switch has no way to verify the user's credentials against the central identity store.

Answer

A DHCP server

Answer

A certificate authority

Answer

A TACACS+ server